Commit 50740a1144 for ffmpeg
commit 50740a1144eb159d4e1408fc03049f8032f1fb11
Author: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed Oct 7 00:54:45 2026 +0200
avformat/rtpdec_rfc4175: Free the pending frame on close
The handler had no close callback, so a frame that was not finalized
when the stream was closed leaked.
Memory leak Replicated through UnModified FFmpeg with ASAN
Found during triage of the security report V8a3e2cGQI7w
diff --git a/libavformat/rtpdec_rfc4175.c b/libavformat/rtpdec_rfc4175.c
index cbb1afd050..a73f59e984 100644
--- a/libavformat/rtpdec_rfc4175.c
+++ b/libavformat/rtpdec_rfc4175.c
@@ -344,6 +344,11 @@ invalid:
return missed_last_packet ? 0 : AVERROR_INVALIDDATA;
}
+static void rfc4175_close_context(PayloadContext *data)
+{
+ av_freep(&data->frame);
+}
+
const RTPDynamicProtocolHandler ff_rfc4175_rtp_handler = {
.enc_name = "raw",
.codec_type = AVMEDIA_TYPE_VIDEO,
@@ -351,4 +356,5 @@ const RTPDynamicProtocolHandler ff_rfc4175_rtp_handler = {
.priv_data_size = sizeof(PayloadContext),
.parse_sdp_a_line = rfc4175_parse_sdp_line,
.parse_packet = rfc4175_handle_packet,
+ .close = rfc4175_close_context,
};